Data We Process
To receive and show a message, Tempburn processes the temporary email address, sender and subject metadata, message text, delivery time, and technical identifiers needed to operate the inbox. The browser receives an HttpOnly session cookie; the service stores a hash of its secret rather than the secret itself.
Cloudflare Turnstile checks inbox-creation requests and may ask for an extra challenge when its risk checks require one. Cloudflare processes the network and request signals needed to provide this protection. Tempburn rate-limit checks may use a short-lived, keyed digest of an IP address. Operator authentication stores only a keyed pseudonym in its session and rate-limit records; the raw client IP and User-Agent are not stored by the application. Do not include private message contents in support requests.
Inbox Access
A message is available only when the browser presents its session cookie and the server confirms that the inbox belongs to that session. An address alone is not an access credential. If the cookie is cleared or the browser is changed, Tempburn cannot recover that inbox for you.
Tempburn is not an end-to-end encrypted email provider. Service operators and infrastructure providers necessarily process message data to deliver, store, and display it.
Retention and Deletion
A standard inbox expires eight days after it is created. Messages share the inbox expiry and may therefore be available for less than eight days. Discarding an inbox or message immediately removes it from normal access; background cleanup then removes online message objects and message records. The operational cleanup target is fifteen minutes. A minimal mailbox deletion marker can remain for recovery safety; it no longer contains the original address local part or message body.
Raw mail is retained only while it is being processed and is removed after successful parsing. Failed processing is retried for a limited period, subject to the inbox expiry. Operator receive probes use an unlisted address that expires after thirty minutes; probe mail is processed only to confirm delivery and is not shown in the console. Provider backups and recovery windows may retain historical copies for a separate period; online deletion does not mean every backup copy disappears immediately.
Logs and Analytics
Application diagnostics are intended to use request and job identifiers rather than email addresses, subjects, message bodies, verification codes, or session cookies. The hosting provider may process its own operational logs and security data under its platform settings and policies.
Google Analytics 4 records page views and Microsoft Clarity records page interactions on public pages. These tools load automatically without an analytics prompt. Inbox content is marked for Clarity masking, and analytics events are excluded on the operator console and API routes.
AI Features and Service Providers
Email AI features are not part of the initial service. Message parsing is limited to extracting plain text and possible verification-code candidates. Cloudflare provides the hosting, database, object storage, queue, and inbound email infrastructure. Each provider handles data under its own terms and retention practices.
Your Choices
You can discard an inbox before expiry. You can also clear the browser cookie, which removes your ability to access it but does not itself request physical deletion; use the discard action when you want the service to start cleanup.
Contact
Use the contact page to reach the service operator. Include a request ID and approximate time if reporting a technical issue. Never send a password, verification code, cookie, or full private message.